CVE-2024-3338

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt data parameter in all versions up to, and including, 1.0.262 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

CVE-2024-28764

IBM WebSphere Automation 1.7.0 could allow an attacker with privileged access to the network to conduct a CSV injection. An attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 285623...

PT-2024-28261 · WordPress · The Royal Elementor Addons/Templates

Name of the Vulnerable Software and Affected Versions: The Royal Elementor Addons and Templates plugin for WordPress versions up to, and including, 1.3.971 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes like accordion title tag i...

PT-2024-25419 · Xuxueli · Xuxueli Xxl-Job

Name of the Vulnerable Software and Affected Versions: Xuxueli xxl-job versions 2.4.0 through 2.4.1 Description: A vulnerability was found in the deserialize function of the file com/xxl/job/core/util/JdkSerializeTool.java of the component Template Handler. This issue leads to injection. The...

python-aiohttp: http request smuggling

An HTTP request smuggling vulnerability was found in aiohttp. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets that must trigger error handling to robustly match frame boundaries of proxies in order to protect against the injection of...

pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE

A flaw was found in the PostgreSQL JDBC Driver. A SQL injection is possible when using the non-default connection property preferQueryMode=simple in combination with application code that has a vulnerable SQL that negates a parameter value...

WordPress Plugin Fancy Product Designer Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2024-2235 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.19 and earlier Description: The issue is a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript m...

PT-2024-22268 · Microsoft · Office Excel

Name of the Vulnerable Software and Affected Versions: Canarytokens versions prior to sha-c595a1f8 Description: The generation of CSV files for incident history in Canarytokens is vulnerable to a CSV Injection issue. This can be exploited by an attacker who discovers an HTTP-based Canarytoken,...

DEBIAN-CVE-2024-24785

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates...

PT-2024-14103 · Hertzbeat · Hertzbeat

Name of the Vulnerable Software and Affected Versions: Hertzbeat versions prior to 1.4.1 Description: Hertzbeat is a real-time monitoring system. In CalculateAlarm.java, AviatorEvaluator is used to directly execute the expression function, and no security policy is configured, resulting in...

PT-2024-20318 · Supabase · Supabase Postgresql

Name of the Vulnerable Software and Affected Versions: Supabase PostgreSQL version 15.1 Description: A SQL injection issue was discovered via the component /pg meta/default/query. However, the vendor's position is that this is an intended feature, existing in the Supabase dashboard product for...

PT-2024-20260 · Unknown · Springboot-Manager

Name of the Vulnerable Software and Affected Versions: springboot-manager version 1.6 Description: The issue is related to Cross Site Scripting XSS via the "/sysContent/add" API endpoint. This allows for potential malicious script injection. No information is provided about the estimated number o...

PT-2024-11920 · WordPress · Givewp

Name of the Vulnerable Software and Affected Versions: GiveWP WordPress plugin versions prior to 2.24.1 Description: The issue concerns the improper escaping of user input before it reaches SQL queries, potentially allowing unauthenticated attackers to perform SQL Injection attacks...

TRENDnet TV-IP1314PI Command Injection Vulnerability

The TRENDnet TV-IP1314PI is a wireless network camera from TRENDnet. The TRENDnet TV-IP1314PI suffers from a command injection vulnerability, which originates from davinci's use of the system function to unpack language packets without strict filtering of URL strings, which can be exploited by an...

CVE-2023-6158

The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the evoeventpostupdatemeta function in all versions up to, and including, 4.5.4 for Pro and 2.2.7 for free. This make...

Apple macOS Ventura Security Vulnerability

Apple macOS Ventura is a desktop operating system from Apple Inc. in the United States. A security vulnerability exists in Apple macOS Ventura version 13.4, which stems from an application that may be able to inject code into sensitive binaries bundled with Xcode...

PT-2023-31668 · Unknown · Login Lockdown

Name of the Vulnerable Software and Affected Versions: Login Lockdown – Protect Login Form versions n/a through 2.06 Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as 'SQL Injection'. This allows for potential exploitation by...

PT-2023-30168

Name of the Vulnerable Software and Affected Versions Talent Software ECOP versions prior to 32255 Description The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as 'SQL Injection', which allows Command Line Execution through SQL Injection...

PT-2023-31315

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 2.1.2 Apache Superset versions 3.0.0 through 3.0.1 Description A where in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache...